Access Control Bypass in Gogs Open Source Git Service

CVE-2026-25232

What is CVE-2026-25232?

Gogs, a self-hosted Git service, has a significant access control bypass vulnerability present in versions 0.13.4 and earlier. This issue allows any collaborator with Write permissions to delete protected branches, including the default branch, by sending a direct POST request. The vulnerability arises because the deletion operation through the web interface circumvents the branch protection mechanism, which is otherwise enforced by Git Hooks during SSH pushes. As a result, low-privilege users can escalate their access levels to perform actions typically reserved for administrators. To mitigate this risk, users must upgrade to version 0.14.1, which addresses this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References